CVE-2019-14892

CRITICAL

jackson-databind < 2.6.7.3 - Remote Code Execution via Polymorphic Deserialization

Title source: llm
STIX 2.1

Description

A flaw was discovered in jackson-databind in versions before 2.9.10, 2.8.11.5 and 2.6.7.3, where it would permit polymorphic deserialization of a malicious object using commons-configuration 1 and 2 JNDI classes. An attacker could use this flaw to execute arbitrary code.

References (6)

Core 6
Core References
Issue Tracking, Patch, Third Party Advisory x_refsource_confirm
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14892
Issue Tracking, Third Party Advisory x_refsource_misc
https://github.com/FasterXML/jackson-databind/issues/2462
Third Party Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2020:0729
Third Party Advisory x_refsource_confirm
https://security.netapp.com/advisory/ntap-20200904-0005/

Scores

CVSS v3 9.8
EPSS 0.0087
EPSS Percentile 75.7%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-502 CWE-200
Status published
Products (10)
apache/geode 1.12.0
com.fasterxml.jackson.core/jackson-databind 0 - 2.6.7.3Maven
fasterxml/jackson-databind 2.0.0 - 2.6.7.3
redhat/decision_manager 7.0
redhat/jboss_data_grid
redhat/jboss_data_grid 7.0.0
redhat/jboss_enterprise_application_platform 7.0
redhat/jboss_fuse 7.0.0
redhat/openshift_container_platform 4.3
redhat/process_automation 7.0
Published Mar 02, 2020
Tracked Since Feb 18, 2026